A computer network is a collection of interconnected computing devices that can exchange data and share resources. In a packet-based network, such as the Internet, the computing devices communicate data by dividing the data into small blocks called packets, which are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.
The packets are communicated according to a communication protocol that defines the format of the packet. A typical packet, for example, includes a header carrying source and destination information, as well as a payload that carries the actual data. The de facto standard for communication in conventional packet-based networks, including the Internet, is the Internet Protocol (IP).
In some cases, a Law Enforcement Agency (LEA) may require the system administrator to mirror network traffic flowing to and from a designated network user. The original network traffic is routed across the network as usual while a mirrored version of the network traffic is forwarded for analysis. The term “lawful intercept” is used to describe the process by which LEAs conduct electronic surveillance of packet-based communications as authorized by a judicial or administrative order. Increasingly, legislation and regulations are being adopted that require public and private service providers to support authorized electronic surveillance. This increase is due in part to the increased use of computer networks for real-time voice communications using, for example, Voice over IP (VoIP).
Conventionally, lawful intercept of a network service, such as VoIP, has been enabled and managed by the system administrator interacting with a command line interface presented by a network device providing the network service. This technique may become difficult as the number of network services and respective devices increase. Delay and other difficulties may arise as both the number of filtering criteria entered and the number packet flows being monitored increases. For example, an undesirably long delay may occur from the time a new filtering criterion is entered until packets meeting the criterion may be captured.